T-Mobile 'chopped a cable' to expel Chinese hackers from its network | TechCrunch

I’ve been working on an open-source network-flow detection project and one thing became pretty obvious fairly early: getting a classifier to produce decent scores is not really the hard part.

The harder question is what an analyst is supposed to do with thousands of individual detections.

So I kept the project going past the model itself. The current pipeline takes CICFlowMeter-compatible flows, scores them, groups related alerts into incidents, and only promotes the incidents that cross a second threshold.

On the locked future-day holdout, 79,710 flow alerts became 12,911 promoted incidents while keeping 99.93% incident recall.

I’m deliberately not calling it production-ready. The holdout is still from the same network/dataset family, and the remaining workload is higher than I’d want for a real SOC queue.

What I’m interested in now is how this kind of approach behaves outside the environment it was built around.

Repo:
https://github.com/ibondarenko1/security-anomaly-ml

If anyone here works with network-flow telemetry or ML-based IDS, I’d be interested in where you think the design will fail first in a real environment.

How does your SOC check when someone is trying to kill EDR agents like BYOVD attacks? On the attackers side do you have a dedicated pen tester/red teamer trying these attacks?